| Título | jofpin trape latest (main/master branch) CWE-306 |
|---|
| Descrição | The SocketIO event handlers on the /trape namespace perform zero authentication. The 'join' handler allows any connected client to join any room (victim sessions are keyed by vId). The 'my_room_event' handler emits attacker-controlled data including type fields like 'redirect', 'execute', 'jscode', 'jsscript', 'alert', and 'talk' to any specified room. These message types correspond to attack actions on tracked victims (redirecting, downloading files, injecting scripts, sending voice messages). The broken business rule is that operator-only command channels to victims have no access control, allowing any network observer to hijack victim sessions or inject arbitrary commands. Exploitation: An attacker connects to the trape SocketIO endpoint at ws://target:port/socket.io (namespace /trape). They emit a 'join' event with a victim's room name (the vId, a short 5-character token visible in network traffic or guessable). They then emit 'my_room_event' with {room: victim_vId, data: {type: 'jsscript', message: 'malicious_payload'}} to inject arbitrary JavaScript into the victim's browser, or {type: 'redirect', message: 'http://evil.com'} to redirect the victim. They can also passively listen to all 'my_response' events to intercept data flowing between the operator and victims. |
|---|
| Fonte | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| Utilizador | GalaxynC (UID 98975) |
|---|
| Submissão | 18/07/2026 21h32 (há 2 meses) |
|---|
| Moderação | 06/09/2026 20h24 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room Autenticação fraca] |
|---|
| Pontos | 0 |
|---|